Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
03/10/2021, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
4e9e6a2c8dbac36a98a396be8c3ba925.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4e9e6a2c8dbac36a98a396be8c3ba925.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 4e9e6a2c8dbac36a98a396be8c3ba925.exe
- Size 298KB
- Sample211003-ehc4csfbbn
- SHA256 774e2e652ad3d2c07841a504968277fa949ba80a30e621fc340efa68ee0403b3
- MD5 4e9e6a2c8dbac36a98a396be8c3ba925
- SHA1 40b9da7d065f4549590bff7a8bc6cf6fbe74d667
- SHA512 6446f8bebf6fbff239b8b1adb1ef63a9e3a055adad1115bd7b4b0afb9340eb8c2db4c3eeb3a8eccfd4f6d32fe7181508c4c5519dbe0b213dc45b6716f047cea2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fiskahlilian16.top/
-
http://paishancho17.top/
-
http://ydiannetter18.top/
-
http://azarehanelle19.top/
-
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
-
raccoon
Botnet
-
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
-
redline
Botnet
-
1234
C2
-
94.26.248.150:17618
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
resource yara_rule behavioral2/memory/4920-138-0x00000000025E0000-0x00000000025FF000-memory.dmp family_redline behavioral2/memory/4920-147-0x0000000002790000-0x00000000027AE000-memory.dmp family_redline - SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
pid Process 4720 B716.exe 4784 B9B7.exe 4856 C9F4.exe 4920 CE89.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C9F4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C9F4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion B716.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion B716.exe - Deletes itself 1 IoCs
pid Process 3048 Process not Found - Loads dropped DLL 5 IoCs
pid Process 4784 B9B7.exe 4784 B9B7.exe 4784 B9B7.exe 4784 B9B7.exe 4784 B9B7.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000200000001ab5c-119.dat themida behavioral2/files/0x000200000001ab5e-126.dat themida behavioral2/memory/4856-133-0x0000000000DE0000-0x0000000000DE1000-memory.dmp themida behavioral2/memory/4720-177-0x00000000003F0000-0x00000000003F1000-memory.dmp themida - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C9F4.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B716.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4856 C9F4.exe 4720 B716.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4648 set thread context of 4672 4648 4e9e6a2c8dbac36a98a396be8c3ba925.exe 68 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4e9e6a2c8dbac36a98a396be8c3ba925.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4e9e6a2c8dbac36a98a396be8c3ba925.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4e9e6a2c8dbac36a98a396be8c3ba925.exe - Delays execution with timeout.exe 1 IoCs
pid Process 860 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4672 4e9e6a2c8dbac36a98a396be8c3ba925.exe 4672 4e9e6a2c8dbac36a98a396be8c3ba925.exe 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4672 4e9e6a2c8dbac36a98a396be8c3ba925.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeDebugPrivilege 4856 C9F4.exe Token: SeDebugPrivilege 4920 CE89.exe Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeDebugPrivilege 4720 B716.exe Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4672 4648 4e9e6a2c8dbac36a98a396be8c3ba925.exe 68 PID 4648 wrote to memory of 4672 4648 4e9e6a2c8dbac36a98a396be8c3ba925.exe 68 PID 4648 wrote to memory of 4672 4648 4e9e6a2c8dbac36a98a396be8c3ba925.exe 68 PID 4648 wrote to memory of 4672 4648 4e9e6a2c8dbac36a98a396be8c3ba925.exe 68 PID 4648 wrote to memory of 4672 4648 4e9e6a2c8dbac36a98a396be8c3ba925.exe 68 PID 4648 wrote to memory of 4672 4648 4e9e6a2c8dbac36a98a396be8c3ba925.exe 68 PID 3048 wrote to memory of 4720 3048 Process not Found 69 PID 3048 wrote to memory of 4720 3048 Process not Found 69 PID 3048 wrote to memory of 4720 3048 Process not Found 69 PID 3048 wrote to memory of 4784 3048 Process not Found 71 PID 3048 wrote to memory of 4784 3048 Process not Found 71 PID 3048 wrote to memory of 4784 3048 Process not Found 71 PID 3048 wrote to memory of 4856 3048 Process not Found 72 PID 3048 wrote to memory of 4856 3048 Process not Found 72 PID 3048 wrote to memory of 4856 3048 Process not Found 72 PID 3048 wrote to memory of 4920 3048 Process not Found 74 PID 3048 wrote to memory of 4920 3048 Process not Found 74 PID 3048 wrote to memory of 4920 3048 Process not Found 74 PID 4784 wrote to memory of 640 4784 B9B7.exe 80 PID 4784 wrote to memory of 640 4784 B9B7.exe 80 PID 4784 wrote to memory of 640 4784 B9B7.exe 80 PID 640 wrote to memory of 860 640 cmd.exe 82 PID 640 wrote to memory of 860 640 cmd.exe 82 PID 640 wrote to memory of 860 640 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e9e6a2c8dbac36a98a396be8c3ba925.exe"C:\Users\Admin\AppData\Local\Temp\4e9e6a2c8dbac36a98a396be8c3ba925.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\4e9e6a2c8dbac36a98a396be8c3ba925.exe"C:\Users\Admin\AppData\Local\Temp\4e9e6a2c8dbac36a98a396be8c3ba925.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4672
-
-
C:\Users\Admin\AppData\Local\Temp\B716.exeC:\Users\Admin\AppData\Local\Temp\B716.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
C:\Users\Admin\AppData\Local\Temp\B9B7.exeC:\Users\Admin\AppData\Local\Temp\B9B7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B9B7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:860
-
-
-
C:\Users\Admin\AppData\Local\Temp\C9F4.exeC:\Users\Admin\AppData\Local\Temp\C9F4.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
C:\Users\Admin\AppData\Local\Temp\CE89.exeC:\Users\Admin\AppData\Local\Temp\CE89.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920